Blocking creation of a network share

NTFSD
1

Hi guys,

Is there a way to monitor and block sharing of a folder? For example if I’d like to protect “c:\test” folder I’d like to deny all access to files within it.
But if someone shares this folder:

net share mytest=c:\test /GRANT:Everyone,FULL

The folder would be accessible through network share circumventing the regular minifilter protection (blocking access to folder based on disposition in PreCreate)

Thank you.

2

Your minifilter will see file accesses from remote clients. They arrive as requests from the System process on a thread impersonating the remote user.

3

Thank you Scott.